MetaMask

MetaMask is a non-custodial cryptocurrency wallet that runs as a browser extension and as a mobile app. It stores a user's keys on their own device and lets them hold ether and tokens, sign transactions and connect to decentralized applications on Ethereum and other networks that use the Ethereum Virtual Machine. For many people it is the first point of contact with decentralised finance and NFTs.

MetaMask is developed by ConsenSys, a blockchain software company founded by Ethereum co-founder Joseph Lubin. The browser extension was released in 2016, and mobile apps followed later. It is one of the most widely used examples of a Web3 wallet and has become a de facto standard: many websites show a "Connect with MetaMask" button, and other wallets copy its interface for compatibility.

Think of MetaMask as a combined keyring and signature stamp that lives in a web browser. The keys prove the user owns certain blockchain accounts, and the stamp lets them approve actions, such as paying someone or trading on an exchange website. When a site wants to do something with the user's money, MetaMask pops up and asks for permission.

No company holds the keys on the user's behalf. That gives full control, but also full responsibility: if the 12-word recovery phrase is lost, nobody can restore access, and if someone else gets it, they can empty the wallet. MetaMask itself does not hold funds; it is a tool for managing accounts that live on the blockchain.

• Key generation. On set-up, MetaMask creates a Secret Recovery Phrase, a type of seed phrase, from which it derives private keys and addresses. The keys are stored encrypted on the device and unlocked with a password.
• Connecting to sites. The extension lets web pages request the user's address and ask for signatures through a standard programming interface, usually called from JavaScript.
• Signing. Each transaction or message is shown for approval, with an estimate of the gas fee. Nothing moves without the user's confirmation.
• Network access. By default, MetaMask reads blockchain data and sends transactions through Infura, a node service owned by ConsenSys, although users can add their own network endpoints.
• Multiple networks. Users can switch between Ethereum and many compatible networks, and add tokens such as ERC-20 assets. The same recovery phrase produces the same addresses on every compatible network, so one set of keys can hold assets on several chains at once.

Over time MetaMask has added a built-in token swap service that compares prices from several sources and charges a service fee, options to buy and sell crypto through third-party payment providers, portfolio and bridging tools, and support for connecting a hardware wallet so keys stay on a separate device. Institutional users can use a separate version designed for organisations that need several approvers and custody arrangements. An extension system called Snaps lets outside developers add features, including support for some non-Ethereum networks. As of 2025, MetaMask had also begun adding native support for other blockchains such as Solana.

As a hot wallet on an internet-connected device, MetaMask is a frequent target. The main threats are:

• Phishing. Fake websites, adverts, emails and support accounts trick users into entering their recovery phrase; genuine MetaMask staff never ask for it. These are forms of phishing.
• Malicious approvals. Some sites ask users to sign token approvals or messages that hand control of their tokens to an attacker, so-called wallet drainers.
• Malware. Information stealers search computers for MetaMask's encrypted storage and try to crack weak passwords.
• Address tricks. Attackers send tiny transfers from look-alike addresses, hoping users will copy the wrong one from their history, a wallet address poisoning scam.

MetaMask has added transaction simulation and warnings for known scam sites, but it cannot stop a user from approving a harmful transaction. Security guides recommend a hardware wallet for large balances, checking every request carefully and revoking token approvals that are no longer needed.

Because MetaMask uses Infura by default, critics have argued that a single company can see a large share of Ethereum wallet activity. In 2022 ConsenSys drew criticism after updating its privacy policy to say that Infura could collect users' IP addresses and wallet addresses when transactions were sent, and it later said it would limit how long such data was kept. Others have criticised the swap fee and the wallet's growing range of commercial services. Supporters point to its open-source code, broad compatibility and role in making Ethereum usable for ordinary people, and newer standards such as account abstraction are changing how wallets like MetaMask may handle keys in future.

• MetaMask